Skip to content

Commit e8eb064

Browse files
author
b31ngd3v
committed
feat(checker): add Apache commons-compress checker
1 parent 03b58d4 commit e8eb064

File tree

8 files changed

+109
-34
lines changed

8 files changed

+109
-34
lines changed

‎.github/actions/spelling/allow.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ cleartext
5858
clnt
5959
cmdline
6060
codecov
61+
commons
62+
compress
6163
conda
6264
config
6365
conventionalcommits

‎README.md

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -244,24 +244,24 @@ The following checkers are available for finding components in binary files:
244244

245245
<!--CHECKERS TABLE BEGIN-->
246246
| | | | Available checkers | | | |
247-
|--------------- |--------- |---------- |--------------- |------------ |--------------- |------------- |
247+
|--------------- |------------- |---------------- |---------- |--------------- |------------ |--------------- |
248248
| accountsservice |avahi |bash |bind |binutils |bolt |bubblewrap |
249-
| busybox |bzip2 |cronie |cryptsetup |cups |curl |dbus |
250-
| dnsmasq |dovecot |dpkg |enscript |expat |ffmpeg |freeradius |
251-
| ftp |gcc |gimp |glibc |gnomeshell |gnupg |gnutls |
252-
| gpgme |gstreamer |gupnp |haproxy |hdf5 |hostapd |hunspell |
253-
| icecast |icu |irssi |jacksondatabind |kbd |kerberos |kexectools |
254-
| libarchive |libbpg |libdb |libebml |libgcrypt |libical |libjpeg_turbo |
255-
| liblas |libnss |librsvg |libseccomp |libsndfile |libsolv |libsoup |
256-
| libsrtp |libssh2 |libtiff |libvirt |libvncserver |libxslt |lighttpd |
257-
| logrotate |lua |mariadb |mdadm |memcached |mtr |mysql |
258-
| nano |ncurses |nessus |netpbm |nginx |node |ntp |
259-
| open_vm_tools |openafs |openjpeg |openldap |openssh |openssl |openswan |
260-
| openvpn |p7zip |pcsc_lite |pigz |png |polarssl_fedora |poppler |
261-
| postgresql |pspp |python |qt |radare2 |rsyslog |samba |
262-
| sane_backends |sqlite |strongswan |subversion |sudo |syslogng |systemd |
263-
| tcpdump |trousers |varnish |webkitgtk |wireshark |wpa_supplicant |xerces |
264-
| xml2 |zlib |zsh | | | | |
249+
| busybox |bzip2 |commons_compress |cronie |cryptsetup |cups |curl |
250+
| dbus |dnsmasq |dovecot |dpkg |enscript |expat |ffmpeg |
251+
| freeradius |ftp |gcc |gimp |glibc |gnomeshell |gnupg |
252+
| gnutls |gpgme |gstreamer |gupnp |haproxy |hdf5 |hostapd |
253+
| hunspell |icecast |icu |irssi |jacksondatabind |kbd |kerberos |
254+
| kexectools |libarchive |libbpg |libdb |libebml |libgcrypt |libical |
255+
| libjpeg_turbo |liblas |libnss |librsvg |libseccomp |libsndfile |libsolv |
256+
| libsoup |libsrtp |libssh2 |libtiff |libvirt |libvncserver |libxslt |
257+
| lighttpd |logrotate |lua |mariadb |mdadm |memcached |mtr |
258+
| mysql |nano |ncurses |nessus |netpbm |nginx |node |
259+
| ntp |open_vm_tools |openafs |openjpeg |openldap |openssh |openssl |
260+
| openswan |openvpn |p7zip |pcsc_lite |pigz |png |polarssl_fedora |
261+
| poppler |postgresql |pspp |python |qt |radare2 |rsyslog |
262+
| samba |sane_backends |sqlite |strongswan |subversion |sudo |syslogng |
263+
| systemd |tcpdump |trousers |varnish |webkitgtk |wireshark |wpa_supplicant |
264+
| xerces |xml2 |zlib |zsh | | | |
265265
<!--CHECKERS TABLE END-->
266266

267267
All the checkers can be found in the checkers directory, as can the

‎cve_bin_tool/checkers/__init__.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
"bubblewrap",
2121
"busybox",
2222
"bzip2",
23+
"commons_compress",
2324
"cronie",
2425
"cryptsetup",
2526
"cups",

‎cve_bin_tool/checkers/commons_compress.py

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Copyright (C) 2022 Intel Corporation
2+
# SPDX-License-Identifier: GPL-3.0-or-later
3+
4+
5+
"""
6+
CVE checker for Apache commons-compress:
7+
8+
https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-59066/Apache-Commons-Compress.html
9+
"""
10+
import re
11+
12+
from cve_bin_tool.checkers import Checker
13+
from cve_bin_tool.util import regex_find
14+
15+
16+
class CommonsCompressChecker(Checker):
17+
CONTAINS_PATTERNS = [
18+
r"Apache Commons Compress software defines an API for working with",
19+
r"<url>http://commons.apache.org/proper/commons-compress/</url>",
20+
]
21+
FILENAME_PATTERNS = [r"commons-compress(-[0-9]+\.[0-9]+(\.[0-9]+)?)?.jar"]
22+
VERSION_PATTERNS = [
23+
r"<artifactId>commons-compress-([0-9]+\.[0-9]+(\.[0-9]+)?)</artifactId>"
24+
]
25+
VENDOR_PRODUCT = [("apache", "commons_compress")]
26+
27+
def get_version(self, lines, filename):
28+
version_info = super().get_version(lines, filename)
29+
lines = lines.split("\n")
30+
31+
index_value = [
32+
i
33+
for i, line in enumerate(lines)
34+
if re.search("<artifactId>commons-compress</artifactId>", line)
35+
]
36+
37+
if not index_value:
38+
return version_info
39+
else:
40+
index_value = index_value[0]
41+
42+
version_string = lines[index_value + 1]
43+
version_pattern = [r"<version>([0-9]+\.[0-9]+(\.[0-9]+)?)</version>"]
44+
version_regex = list(map(re.compile, version_pattern))
45+
new_version = regex_find(version_string, version_regex)
46+
version_info["version"] = new_version
47+
48+
return version_info

‎doc/MANUAL.md

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -128,24 +128,24 @@ which is useful if you're trying the latest code from
128128

129129
<!--CHECKERS TABLE BEGIN-->
130130
| | | | Available checkers | | | |
131-
|--------------- |--------- |---------- |--------------- |------------ |--------------- |------------- |
131+
|--------------- |------------- |---------------- |---------- |--------------- |------------ |--------------- |
132132
| accountsservice |avahi |bash |bind |binutils |bolt |bubblewrap |
133-
| busybox |bzip2 |cronie |cryptsetup |cups |curl |dbus |
134-
| dnsmasq |dovecot |dpkg |enscript |expat |ffmpeg |freeradius |
135-
| ftp |gcc |gimp |glibc |gnomeshell |gnupg |gnutls |
136-
| gpgme |gstreamer |gupnp |haproxy |hdf5 |hostapd |hunspell |
137-
| icecast |icu |irssi |jacksondatabind |kbd |kerberos |kexectools |
138-
| libarchive |libbpg |libdb |libebml |libgcrypt |libical |libjpeg_turbo |
139-
| liblas |libnss |librsvg |libseccomp |libsndfile |libsolv |libsoup |
140-
| libsrtp |libssh2 |libtiff |libvirt |libvncserver |libxslt |lighttpd |
141-
| logrotate |lua |mariadb |mdadm |memcached |mtr |mysql |
142-
| nano |ncurses |nessus |netpbm |nginx |node |ntp |
143-
| open_vm_tools |openafs |openjpeg |openldap |openssh |openssl |openswan |
144-
| openvpn |p7zip |pcsc_lite |pigz |png |polarssl_fedora |poppler |
145-
| postgresql |pspp |python |qt |radare2 |rsyslog |samba |
146-
| sane_backends |sqlite |strongswan |subversion |sudo |syslogng |systemd |
147-
| tcpdump |trousers |varnish |webkitgtk |wireshark |wpa_supplicant |xerces |
148-
| xml2 |zlib |zsh | | | | |
133+
| busybox |bzip2 |commons_compress |cronie |cryptsetup |cups |curl |
134+
| dbus |dnsmasq |dovecot |dpkg |enscript |expat |ffmpeg |
135+
| freeradius |ftp |gcc |gimp |glibc |gnomeshell |gnupg |
136+
| gnutls |gpgme |gstreamer |gupnp |haproxy |hdf5 |hostapd |
137+
| hunspell |icecast |icu |irssi |jacksondatabind |kbd |kerberos |
138+
| kexectools |libarchive |libbpg |libdb |libebml |libgcrypt |libical |
139+
| libjpeg_turbo |liblas |libnss |librsvg |libseccomp |libsndfile |libsolv |
140+
| libsoup |libsrtp |libssh2 |libtiff |libvirt |libvncserver |libxslt |
141+
| lighttpd |logrotate |lua |mariadb |mdadm |memcached |mtr |
142+
| mysql |nano |ncurses |nessus |netpbm |nginx |node |
143+
| ntp |open_vm_tools |openafs |openjpeg |openldap |openssh |openssl |
144+
| openswan |openvpn |p7zip |pcsc_lite |pigz |png |polarssl_fedora |
145+
| poppler |postgresql |pspp |python |qt |radare2 |rsyslog |
146+
| samba |sane_backends |sqlite |strongswan |subversion |sudo |syslogng |
147+
| systemd |tcpdump |trousers |varnish |webkitgtk |wireshark |wpa_supplicant |
148+
| xerces |xml2 |zlib |zsh | | | |
149149
<!--CHECKERS TABLE END-->
150150

151151
For a quick overview of usage and how it works, you can also see [the readme file](README.md).

‎test/condensed-downloads/apache-commons-compress-1.21-1.fc35.noarch.rpm.tar.gz

4.21 KB
Binary file not shown.

‎test/condensed-downloads/commons-compress-1.16.1.jar.tar.gz

3.7 KB
Binary file not shown.

‎test/test_data/commons_compress.py

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright (C) 2022 Intel Corporation
2+
# SPDX-License-Identifier: GPL-3.0-or-later
3+
4+
mapping_test_data = [
5+
{
6+
"product": "commons_compress",
7+
"version": "1.18",
8+
"version_strings": ["<artifactId>commons-compress-1.18</artifactId>"],
9+
},
10+
]
11+
package_test_data = [
12+
{
13+
"url": "https://repo1.maven.org/maven2/org/apache/commons/commons-compress/1.16.1/",
14+
"package_name": "commons-compress-1.16.1.jar",
15+
"product": "commons_compress",
16+
"version": "1.16.1",
17+
},
18+
{
19+
"url": "http://rpmfind.net/linux/fedora/linux/releases/35/Everything/x86_64/os/Packages/a/",
20+
"package_name": "apache-commons-compress-1.21-1.fc35.noarch.rpm",
21+
"product": "commons_compress",
22+
"version": "1.21",
23+
},
24+
]

0 commit comments

Comments
 (0)